feat(security): security headers, session management, API tokens, audit logging

lib/reliability/retryMetrics.ts

@@ -0,0 +1,30 @@
+/**
+ * Stub for retry metrics — provides a reset function used by vitest.setup.ts
+ * between tests.
+ */
+
+let _callCount = 0;
+let _failureCount = 0;
+
+export const retryMetrics = {
+  increment() {
+    _callCount++;
+  },
+  failure() {
+    _failureCount++;
+  },
+  get callCount() {
+    return _callCount;
+  },
+  get failureCount() {
+    return _failureCount;
+  },
+  reset() {
+    _callCount = 0;
+    _failureCount = 0;
+  },
+};
+
+export function resetRetryMetrics(): void {
+  retryMetrics.reset();
+}

next.config.js

@@ -46,6 +46,10 @@ const nextConfig = {
         headers: [
           { key: 'X-Frame-Options', value: 'DENY' },
           { key: 'X-Content-Type-Options', value: 'nosniff' },
+          // X-XSS-Protection enables the browser's built-in XSS filter (IE/Chrome legacy).
+          // Modern browsers rely on CSP instead, but this header provides defence-in-depth
+          // for older clients. Mode=block prevents partial rendering of detected attacks.
+          { key: 'X-XSS-Protection', value: '1; mode=block' },
           { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
           {
             key: 'Strict-Transport-Security',